AIIM White Paper. Digital Signatures - making the business case. Sponsored

Transcription

1 AIIM White Paper Digital Signatures - making the business case Sponsored

2 About the White Paper As the non-profit association dedicated to nurturing, growing and supporting the user and supplier communities of ECM (Enterprise Content Management) and Social Business Systems, AIIM is proud to provide this research at no charge. In this way the entire community can take full advantage of the education thought-leadership and direction provided by our work. Our objective is to present the wisdom of the crowds based on our 70,000-strong community. We are happy to extend free use of the materials in this report to end-user companies and to independent consultants, but not to suppliers of ECM systems, products and services, other than ARX and its subsidiaries and partners. Any use of this material must carry the attribution AIIM / ARX Rather than redistribute a copy of this report to your colleagues, we would prefer that you direct them to www. aiim.org/research for a free download of their own. Our ability to deliver such high-quality research is made possible by the financial support of our underwriting sponsor, without whom we would have to return to a paid subscription model. For that, we hope you will join us in thanking our underwriter for this support: ARX 855 Folsom Street, Suite 939 San Francisco, CA Tel: Website: Process used and survey demographics The survey results quoted in this report are taken from a survey carried out between 03 Oct 2012 and 05 Nov 2012, with 283 responses from individual members of the AIIM community surveyed using a Web-based tool. Invitations to take the survey were sent via to a selection of AIIM s 70,000 registered individuals. Respondents cover a representative spread of industry and government sectors. Results from organizations of less than 10 employees have not been included, bringing the total respondents to 263. About AIIM AIIM has been an advocate and supporter of information professionals for nearly 70 years. The association mission is to ensure that information professionals understand the current and future challenges of managing information assets in an era of social, mobile, cloud and big data. AIIM builds on a strong heritage of research and member service. Today, AIIM is a global, non-profit organization that provides independent research, education and certification programs to information professionals. AIIM represents the entire information management community: practitioners, technology suppliers, integrators and consultants. AIIM runs a series of training programs, including the ECM Master course. About the author Doug Miles is head of the AIIM Market Intelligence Division. He has over 25 years experience of working with users and vendors across a broad spectrum of IT applications. He was an early pioneer of document management systems for business and engineering applications, and has produced many AIIM survey reports on issues and drivers for Capture, ECM, Records Management, SharePoint, Big Data and Social Business. Doug has also worked closely with other enterprise-level IT systems such as ERP, BI and CRM. He has an MSc in Communications Engineering and is a member of the IET in the UK AIIM ARX 1100 Wayne Avenue, Suite Folsom Street, Suite 939 Silver Spring, MD San Francisco, CA AIIM / ARX

3 Table of Contents About the White Paper: About the White Paper... 1 Process used and survey demographics... 1 About AIIM... 1 About the author... 1 Introduction: Introduction... 3 Key findings... 3 Drivers for Digital/Electronic Signing: Drivers for Digital/Electronic Signing... 4 Signatures in Business... 4 Needless Document Printing... 7 Interrupted Processes... 8 Drivers for SharePoint... 9 Adoption of Electronic/Digital Signatures: Adoption of Electronic/Digital Signatures Non-Adapters Technical Understanding Champions and Objectors Characteristics of Signature Solutions: Characteristics of Signature Solutions Sourcing Management Functionality Two-Factor Authentication Conclusion and Recommendations: Conclusion and Recommendations Recommendations References Appendix 1: Survey Demographics: Appendix 1: Survey Demographics Survey Background Organizational Size Geography Industry Sector Role Appendix 2: Digital Signature Primer: Appendix 2: Digital Signature Primer Appendix 3: Open ended comments Appendix 3: Open ended comments Underwritten in part by: ARX AIIM Benefits and Return on Investment: Benefits and Return on Investment AIIM / ARX

4 Introduction As more and more organizations adopt paper-free processes and automate their document-based workflows, the wet ink signature stands out as something of an evolutionary laggard. Electronic signing mechanisms have been with us for a long time, but their adoption has been slow. Some of this is due to a lack of trust on the part of legal counsel despite progressive legislation to the contrary and some is due to confusion between the different mechanisms and technologies involved. All too often it is because the business case is not sufficiently prioritized to push it up the IT to-do list. However, as we rely more and more on electronic workflows and less and less on document exchange via post, fax or courier, the discontinuities and delays caused by physical signing have become harder and harder to ignore. As we have found in this survey report, when existing users make a cost/benefit analysis for the adoption of electronic signing, the payback period is consistently one of the shortest we have seen for any IT investment. Whilst analyzing simple document exchanges provides one dimension of cost-savings, removing the disruptive and delaying effects of physical approval sign-offs within otherwise time-efficient electronic processes generally adds a much bigger benefit. As we described in the The Paper Free Office, 1 replacing space-hungry, slow and unresponsive processes with electronic workflows has huge benefits, particularly as businesses look to become more diverse and more mobile. However, paper can easily creep back in if we let it. Printing documents to collect signatures is still very prevalent even in otherwise paper-free environments, slowing things down and clogging up desks. In this report, we look at the drivers for electronic signing, the general understanding of the different technologies, the issues that might be preventing adoption, and the ROI that is being achieved by users. We also track changes from our previous survey in For those needing a technical and legal appreciation of the differences between electronic signatures, and digital signatures based on Public Key Infrastructures (PKI), please refer to Appendix 2 and References 2-7. Key Findings ROI The payback period is consistently one of the shortest we have seen for any IT investment: 81% of existing digital signature users have seen a payback within one 12-month budget cycle. 25% saw ROI in three months or less. The two biggest benefits are saving of staff time and speeding up the approval process. Saving of paper-handling costs comes next, particularly courier charges. Drivers Major process interruptions and delays due to employees still signing with pen and paper Authorization signatures are considered essential for 58% of responding organizations. Over half need to bring travelling, remote or home-based employees into the signing loop. 40% need signatures from people outside the organization. For 44% of organizations, half or more of their processes are interrupted by the need to collect physical signatures. The average across all respondents is that 42% of processes are interrupted. On average, 3.1 days is added to most processes in order to collect physical signatures. 22% of organizations add a week or more to their processes. 48% of process documents are printed for the sole purpose of adding signatures. For 26% of organizations, this rises to over 80% of printed process documents. AIIM / ARX

5 60% of respondents admit that they frequently print and sign documents and then scan them back in to their DM/ECM system. 64% frequently print, sign and file manually. 33% regularly print, sign and courier documents. On average, 2.1 additional copies are printed of each process document in order to collect signatures. 32% create three or more copies of each process document. Adoption 35% of organizations have already automated their signature-dependent processes 35% of organizations who have answered the survey are already using digital/electronic signatures, up from 24% in the 2010 survey. A further 11% have plans in the next 12 months. Self-managed in-house digital signature (PKI) solutions are the most popular with existing users, but planned users are evenly split between this and server or appliance-based PKI systems. 30% are using non-pki solutions. Lack of familiarity with the technology is the most tangible reason for non-adoption, as it was in the previous survey. 35% still report general unfamiliarity with legal admissibility and industry specifics, 40% don t really understand digital signatures and PKI mechanics, and half are confused about encryption and the issues of self-certification. Lack of priority and the perceived level lack of financial return feature highly as reasons not to adopt. Difficulty of working outside the firewall with external partners and customers is ranked as number three. Process owners and signers are the most keen to adopt. Compliance/Records Managers and Finance are mostly in favour. Lawyers and auditors are not so keen. The IT staff have the biggest influence but are somewhat ambivalent. System Characteristics Highest ranked features: signing multiple file types and managing signatures through Active Directory profiles 46% of user organizations have 50 signers or less. A quarter have more than % are using an in-house-developed management interface or are managing individual certificates. Only 19% are managed through Active Directory. Two-factor authentication is used in 45% of organizations. Mostly numeric key fobs at login time, but also ipads or other tablets at signing time. Existing users look for the ability to sign multiple file types, and for one-click sign-and-encapsulate functions. It is also important that multiple signatures can be added to already signed and sealed documents. Managing signatures as part of Active Directory profiles is important, as is batch signing of documents in SharePoint. Approving workflow processes or forms with non-refutable signatures is particularly important for SharePoint users. Drivers for Digital/Electronic Signing Signatures in Business Unsurprisingly, the importance of signatures has not changed at all since our previous report in 2010, with 81% of respondents considering them to be very important or essential within their regulatory environment. Industry sectors of Government, Healthcare, Pharmaceutical and Banking and Finance place the highest store on signatures for their day-to-day activities. This also reflects a higher dependence in larger organizations (66% essential) compared to smaller ones (49% essential). 4 AIIM / ARX

6 Figure 1: With regard to the regulatory environment or standard business practices in your industry, how important are authorization signatures within your organization? (N=263) Essen al Very important Essen al Somewhat important Very important Not that important Somewhat important 0% 10% 20% 30% 40% 50% 60% 70% 0% 10% 20% 30% 40% 50% 60% 70% Not that important When it comes to why and where signatures are used, internal compliance, external regulation, and authorizations for contracts or payments are prevalent. 60% have a strong legal requirement for signatures. Figure 2: For which of the following 0% needs are 20% authorization 40% signatures 60% considered 80% essential in your organization? (Tick all that are significant) (N=262) Internal compliance 0% 20% 40% 60% 80% Required by regula ons Internal compliance Authoriza on for ac on or payment Required by regula ons Contracts with 3rd par es Authoriza on for ac on or payment Required by law Contracts with 3rd par es Consent/agreement by customers, pa ents, ci zens, etc. Required by law Professional authority (doctors, inspectors, Consent/agreement by customers, etc.) pa ents, ci zens, etc. Health and safety Professional authority (doctors, inspectors, etc.) Health and safety When analyzing the use of signatures, it is important to consider the process as a whole rather than just the document or form that is used 0% as the carrier 5% for the 10% signature. 15% On average, 20% around half of the processes need signatures at some point, but in some organizations almost all processes require an authorization signature. 10% or less 10-20% of processes/docs 0% 5% 10% 15% 20% 20-30% of processes/docs 10% or less 30-50% 10-20% of processes/docs of processes/docs 50-70% 20-30% of processes/docs of processes/docs AIIM % 30-50% of processes/docs / of ARX processes/docs Average: 42.4% Average: 42.4% 5

7 etc.) Authoriza on for ac on or payment Health and safety Contracts with 3rd par es Figure 3: What percentage Required of the by main law business processes/documents in your organizational unit would you say require authorization signatures? (N=260) Consent/agreement by customers, pa ents, ci zens, etc. Professional authority (doctors, inspectors, 0% 5% 10% 15% 20% etc.) 10% or less Health and safety 10-20% of processes/docs 20-30% of processes/docs 30-50% of processes/docs 50-70% of processes/docs 70-80% of processes/docs 80% 10% or more less 10-20% of processes/docs Average: 42.4% 20-30% of processes/docs Even quite small businesses will have a few authorized signers who formally sign documents Average: two 42.4% or more times a day. In 30-50% larger of organizations processes/docs the number rapidly grows to many hundreds of people, signing thousands of documents 50-70% a of day. processes/docs 0% 20% 40% 60% 80% It is increasingly the case that the managers who need to sign-off documents or processes are frequent travellers, or may be 70-80% based of in processes/docs remote or overseas offices, and this creates problems for over half of Local managers and employees our respondents. Distributing the 80% documents or more electronically is not an issue these days, but collecting a physical signature Senior execu ves is, and who as we frequently all get more connected, any delay in an authorization response becomes less and less acceptable. Forty-two travel per cent would also like to include customers and clients in the loop. Employees in remote/overseas offices Figure 4: As part of your main business workflows, who of the following are required to sign and return Field-based documents staffor approve your process steps? (N=256) Partners, suppliers or sub-contractors Local managers Customers and employees or clients Senior execu ves who frequently External authorizing professionals travel Employees in remote/overseas offices 0% 5% 10% 15% 20% 0% 20% 40% 60% 80% Field-based staff Partners, suppliers or sub-contractors Customers or clients External authorizing professionals 6 AIIM / ARX

8 Needless Document Printing Half or more of the printed process documents are printed just to add a signature in the 48% of organizations without digital signature solutions. Averaging the figure over all non-user organizations, 48.2% of all process documents would not need to be printed if a digital signature system was in place. See figure 5. Wherever the signer is located, if documents have to be printed, posted, faxed, physically signed and rescanned, this adds costs, delays and staff inefficiencies. Figure 5: Considering the documents that are printed out as part of your formal approval processes, what proportion would you say are printed for the sole purpose of adding one or more signatures? (N=153 non-users) 10% or less 10-20% of docs 20-30% of docs 30-50% of docs 50-70% of docs 70-80% of docs 10% or less 80-90% 10-20% of docs of docs 90% or 20-30% more of docs 30-50% of docs 0% 5% 10% 15% 20% Average: 48.2% 0% 5% 10% 15% 20% Average: 48.2% We also found that on 50-70% average, of docs 2.1 additional print copies, photocopies or fax copies of each process document are likely to be needed in order to collect signatures. For a third of organizations it is three or 70-80% of docs more additional copies all of which need to be handled distributed and filed. Other wasteful practices 80-90% include of 0% docs the 60% 20% who 40% frequently 60% print born-digital 80% 100% documents for signature and then scan them into a document management or ECM system, including 30% who do this every day. Printed, signed and scanned 90% in to or a more To beat postal delays, 33% admit to regularly printing, signing and then couriering documents, with the DM/ECM system? associated costs and delivery difficulties. Just looking at Figure 6, and thinking of all the unnecessary Printed, handling signed costs and involved, filed manually? shows how this simple aspect of business creates so many inefficiencies. Figure 6: In your organizational unit, how frequently are documents: (N=153, non-users) Printed, signed and couriered? Printed, signed and fed into the fax machine? Printed, signed and scanned in to a 0% 20% 40% 60% 80% 100% DM/ECM system? Every day O en Occasionally Never Printed, signed and filed manually? Printed, signed and couriered? Printed, signed and fed into 0% the fax 5% 10% 15% 20% 25% machine? 10% or less 10-20% processes Every day O en Occasionally Never 20-30% processes AIIM % processes Average: 42.3% / ARX % processes 0% 5% 10% 15% 20% 25% 7

9 0% Printed, signed and scanned in to a Printed, signed and DM/ECM scanned system? in to a DM/ECM system? 20% 40% 60% 80% 100% Printed, signed and filed manually? Printed, signed and filed manually? Interrupted Printed, signed Processes and couriered? We Printed, also asked signed non-users and couriered? what proportion of their electronic or scanned document workflows are Printed, signed and fed into the fax interrupted or prematurely completed by the need to collect physical signatures. For 44%, half or more Printed, signed and fed into machine? the fax of their workflows are impacted. This is a rise of 4% since the last survey, indicating general progress machine? towards more paper-free processes, Every day despite O en that final Occasionally hurdle of the Never signature placement. On average, 42.3% of processes are slowed Every down. day O en Occasionally Never Figure 7: What proportion of your key processes would you say are interrupted, slowed down or prematurely completed by the need to collect physical signatures on paper? (N=153 non-users) 0% 5% 10% 15% 20% 25% 0% 10% or less 10% or less 10-20% processes 10-20% processes 20-30% processes 5% 10% 15% 20% 25% 20-30% processes 30-50% processes Average: 42.3% 30-50% processes Average: 42.3% 50-70% processes 50-70% processes 70-80% processes 70-80% processes 80-90% processes 80-90% processes 90% or more 90% or more Looking at the extent of the slowdown, 65% think at least a day is added to their processes in order to collect physical signatures. For 22% it s a week or more. The average is 3.1 days. Just in terms of business agility, this is a serious issue, but if reflected into customer response, it indicates a major opportunity for improvement. Figure 8: How much time would you say is generally added to a typical formal approval process as a result of this physical sign-off? (N=151) 0% 10% 20% 30% 0% 10% 20% 30% A few hours A few hours Half a day Half a day 1 day 1 day 2-3 days Average: 3.1 days 2-3 days One week Average: 3.1 days One week Two weeks Two weeks More than 2 weeks More than 2 weeks 8 AIIM / ARX

10 Drivers for SharePoint Only one in four SharePoint installations are used to manage documents or processes that need approval. Two thirds of the organizations in our survey use SharePoint in some way, but in more regulated industries, its use tends to be relegated to team collaboration and intranet portals. SharePoint is relatively straightforward to use for many workflow processes including staff claims, purchase requisitions, project reports, etc. Generally, a tick box is used to indicate approval, relying on the login password for authentication. As applications become more business critical, processes which are part of a regulatory regime or with legal implications, are increasingly likely to find their way onto SharePoint. At that point it is important to have a more rigorous sign-off mechanism. Despite the ready availability of off-the-shelf digital signature solutions that readily integrate with SharePoint, IT departments may be tempted to create their own. They should be careful when creating or incorporating less standard electronic signature solutions to ensure that an auditable security regime is maintained. Manual PKI solutions should also be approached carefully due to ease-of-use and scaling issues. 69% of the organizations surveyed have a need to add multiple signatures to documents in SharePoint, generally in a specific order. 40% need to add a non-refutable signature to a workflow process or form approval, and 34% are using InfoPath forms that need to be signed. Users are also keen to sign off batches of documents in one operation, or to sign off list items on a per item basis. Figure 9: Do you have any of the following requirements within SharePoint? (N=62, excl. 175 None of these, N/A ) Adding a single signature within a document Adding mul ple signatures to a document in a specific order Signing mul ple documents in one opera on (batch signing) Signing a document automa cally upon a certain trigger Adding a non-refutable signature to a workflow process or form approval Signing off on list items on a per item basis 0% 20% 40% 60% 80% Signing an InfoPath form with single/mul ple signatures 0% 10% 20% 30% 40% 50% 60% We are already using them today We plan to implement them in the next 12 months We have plans to implement them in the next 2 years AIIM / ARX We see the need for them but emps 500-5,000 emps 5,000+ emps 9

11 specific order Signing mul ple documents in one opera on (batch signing) Signing a document automa cally upon a certain trigger Adoption Adding a non-refutable of Electronic/Digital signature to a workflow Signatures process or form approval Our survey response was self-elected, and so at 35%, it is likely to overestimate those already using digital signatures. In our previous survey we measured 24% of current users. Overall growth is very strong, Signing with a off further on list 22% items planning on a per item to go basis ahead within the next 2 years. Half of the largest organizations are already users, compared to a quarter of the rest, but this is quite even across both small and midsized organizations. Signing an InfoPath form with single/mul ple signatures Figure 10: How would you describe the use of digital/electronic signatures in your organizational unit? (N=242) Non-Adopters We are already using them today We plan to implement them in the next 12 months We have plans to implement them in the next 2 years We see the need for them but have no plans at present We don t see the need for them 0% 10% 20% 30% 40% 50% 60% 0% 20% 40% 60% emps 500-5,000 emps 5,000+ emps As indicated We have higher in the priority previous IT graph, projects everyone right now can see the need for digital signatures, but Figure 11 shows that it is not seen as a priority by the IT department. A number of other factors are also in play, the strongest of which is a lack of familiarity with the technology. This has not changed position since Not familiar with the technology our previous survey despite AIIM s efforts with regular webinars and conference presentations. Having said We that, require the signatures preference from for external time-honoured customers methods has dropped slightly and the issue of dealing with external customers and and partners in our beyond workflow the firewall has come to the fore. It is Management hoped that as do secure not consider cloud it or a worthwhile SaaS solutions become more accepted, this issue can be overcome investment and indeed 23% of respondents would have no problem with a cloud solution per se as long as it Staff did what prefer they me-honored need. The manual issue of signatures legal admissibility that in court has dropped three positions to last place they understand compared to the previous survey, which is encouraging, although we will see later that there is still resistance We don't from do enough legal counsel authorized and signing auditors be to the idea of electronic signatures. worthwhile Managing the cer ficates for all the staff is too me-consuming We don t see the business benefits The cer ficates are too expensive to acquire Our regulators will not accept them They are not legally admissible in court 10 AIIM / ARX

12 We We don t have see plans the need to implement for them them in the next 2 years emps 500-5,000 emps 5,000+ emps We see the need for them but Figure 11: What would you say are the most prevalent reasons that digital/electronic signatures have no plans at present are not currently used in your organizational unit maximum THREE? (N=153, non-users) We have higher priority IT projects right now Technical Understanding We don t see the need for them Not familiar with the technology 0% 20% 40% 60% We require signatures from external customers and partners in our workflow 0% Management do not consider it a worthwhile We have higher priority IT projects investment right now Staff prefer me-honored manual signatures that they understand Not familiar with the technology We don't do enough authorized signing to be We require signatures from external worthwhile customers and partners in our workflow Managing the cer ficates for all the staff is too Management do not consider me-consuming it a worthwhile investment 20% 40% 60% Staff prefer me-honored We don t see manual the business signatures benefits that they understand We The don't cer ficates do enough are too authorized expensive signing to acquire to be worthwhile Managing the Our cer ficates regulators for will all not the accept staff is them too me-consuming They are not legally admissible in court We don t see the business benefits The cer ficates are too expensive to acquire Looking in more detail Our regulators this unfamiliarity will not accept with them how 0% these 10% systems 20% 30% work, 40% 50% we asked 60% 70% respondents 80% 90%100% how well understood various aspects of digital or electronic signing were in their organization which is not to say that Legisla on They the respondents are not admissibility legally themselves admissible of electronic in are court not sufficiently knowledgeable. All organizations are included here, users and non-users. For signatures more details on these topics, see Appendix 2. Figure 12: How well understood would you say are the following aspects of digital/electronic Regula ons in your industry regarding signatures signatures in your organization? (N=223 All) Difference between graphical/ electronic signatures and digital signatures 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%100% Legisla on on admissibility of electronic How public keys work (PKI signatures standards) What ID cer ficates and Cer ficate Authori es Regula ons in your industry regarding signatures (CAs) are Difference The difference between between graphical/ encryp on electronic and signatures and digital encapsula on signatures The problem with self-signed cer ficates in How public keys work (PKI standards) Word or Acrobat What ID cer ficates and Cer ficate Authori es Fully understood (CAs) are Par ally understood Not well understood The difference between encryp on and encapsula on The problem with self-signed cer ficates in Word or Acrobat Fully understood Par ally understood Not well understood AIIM / ARX

13 Champions and Objectors One of the most revealing questions compares those who are the most keen to adopt electronic signing with those who are the most reluctant. Process owners and in particular, authorized signers are the most in favour. Internal legal counsel and in particular external lawyers and auditors are the most resistant although for the latter, this may be a perception rather than a reality. However, the length of the lines in Figure 12 indicates the degree of influence that these different departments have. IT are the most likely to be involved in the decision, and the survey shows them to be the most ambivalent with equal numbers for and against Figure 13: Who in your organization would you say are/would be the most keen/most reluctant to move to electronic signing? (Max TWO) (N=262) IT Line of business/process owners Authorized signers Compliance/Records Finance CEO/Board Internal legal counsel External auditors External lawyers None of these -40% -30% -20% -10% 0% 10% 20% 30% 40% 50% Most Reluctant Characteristics of Signature Solutions Most Keen 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% Self-managed We discussed in-house earlier digital that there signatures was a (PKI) general lack of understanding of electronic signature technology and to some extent this is because of the variety of solutions in the market which operate in quite different ways. There are also a number of national and international standards in this area which are Password/signing tablets/internal sign-offs only slowly converging. We are not going to discuss these differences here, but would once again Web suggest work-flow reading (+ archive) Appendix electronic 2 particularly signatures regarding the differences between electronic signatures and digital signatures. (non-pki) From 3rd-party Figure managed 14 we can digital see signatures that the traditional (PKI) approach has been to use a self-managed or selfdeveloped system using PKI certificates. This can be an expensive approach that is quite tricky to manage, Server or and appliance-based we can see that digital for signatures those planning a system, server or appliance-based PKI solutions are becoming more popular, relatively speaking. (PKI) The SaaS/Cloud-based largest organizations digital are signatures nearly three (PKI) times more likely to be using web work-flow and only half as SaaS/Cloud-based likely to use self-managed electronic signatures PKI. Large companies have the experience that traditional PKI implementations are difficult and expensive (non-pki) to scale. Additionally, in the US, non-pki e-signature web applications are used despite their lack of standards compliance and other limitations. Other Actual Planned 12 AIIM / ARX

14 Sourcing Authorized External lawyers signers Compliance/Records None of these Finance Most Reluctant Most Keen CEO/Board Figure 14: How would Internal you describe legal counsel your main digital/electronic signature solution? (N=83 using now, 27 planned) External auditors External lawyers0% 5% 10% 15% 20% 25% 30% 35% 40% 45% None of these Self-managed in-house digital signatures (PKI) Most Reluctant Most Keen Password/signing tablets/internal sign-offs Web work-flow (+ archive) electronic signatures (non-pki) 3rd-party managed digital signatures (PKI) 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% Server or appliance-based digital signatures Self-managed in-house digital signatures (PKI) (PKI) Password/signing SaaS/Cloud-based tablets/internal digital signatures sign-offs (PKI) Web work-flow SaaS/Cloud-based (+ archive) electronic signatures (non-pki) 3rd-party managed digital signatures Other (PKI) Server or appliance-based digital signatures (PKI) Actual SaaS/Cloud-based digital signatures (PKI) Planned SaaS/Cloud-based electronic signatures When it comes to the delivery method for (non-pki) a digital or electronic signature system, the traditional base of heavily regulated industries are likely to have acquired it as part of a DM or ECM system particularly larger organizations (32%). Those planning Other a system now are more likely to procure a 3rd party product 0% 5% 10% 15% 20% 25% 30% 35% and to integrate it in-house. There are still some who are likely to develop a system themselves, particularly smaller businesses (36%), although the Actual risk here is either Plannedthat it will not be as secure as it should be, or that it Built becomes into our unwieldy ECM/DM to system manage when scaled. All of the effort involved in implementing a digital signature solution will come to naught if its veracity cannot be upheld in court. Supplied by a VAR or SI in associa on Figure 15: with How a new was ECM/DM your digital/electronic system signature solution delivered? (N=83 using now, 27 planned) Supplied by a VAR or SI and integrated with exis ng DM system Procured as a 3rd party product or 0% 5% 10% 15% 20% 25% 30% 35% service and integrated in-house Built into our ECM/DM system Developed in-house Supplied by a VAR or SI in associa on with a new ECM/DM system Ad hoc per-user solu on Supplied by a VAR or SI and integrated with exis ng DM system Other Procured as a 3rd party product or service and integrated in-house Current Users Planned Developed in-house Ad hoc per-user solu on Other 0% 5% 10% 15% 20% 25% 30% 35% Current Users Planned On a user-cer ficate-by-usercer ficate basis AIIM In-house / developed ARX management interface 13

15 with exis ng DM system Procured as a 3rd party product or service and integrated in-house Management Developed in-house Ad hoc per-user solu on When it comes to managing a system, especially those with many signers, it becomes particularly important to have automatic synchronization with the organization s Active Directory or similar system. This will minimize costs for enrolling, updating Other and off-boarding signers. It will ensure that when a staff member leaves, their signing certificate will automatically be immediately retired. Automating signatures should not add a new manual system for administering Current the community Users Planned of authorized signers. Signing systems in use cover a wide range of user numbers, with 24% having less than 10 signers, and 23% having more than 500. Scaleability of costs is therefore important, but smaller organizations should not assume that a digital signature solution will be too expensive. Figure 16: How do you set up and maintain users of your digital/electronic signature system? (N=81 users) On a user-cer ficate-by-usercer ficate basis In-house developed management interface Linked to Ac ve Directory (or other directory service) Dedicated management interface provided by 3rd party solu on Other/Don t know 0% 5% 10% 15% 20% 25% 30% 35% Functionality Signing multiple file types is the most important feature for a digital signature solution. The next most important feature is integration with a directory service, showing the importance of minimizing administrative costs. Feature sets are likely to vary considerably between different offerings, particularly modern systems compared with older ones, but to set a baseline, we asked existing users which functions they felt were the most important. One-click signing and encapsulation, and adding multiple signatures to otherwise encapsulated documents are also core requirements. For heavy SharePoint users, ready integration to SharePoint processes is also an important factor. Figure 17: Based on your experience, which four of the following features, would you consider the most important in a digital/electronic signatures solution? (Max FOUR) (N=80 users) 0% 10% 20% 30% 40% 50% 60% Addi on of signatures to mul ple file types Manage signatures as part of AD profile One click signature addi on and encapsula on Mul ple signatures onto encapsulated docs Signing for SharePoint process steps Tablet signing Batch signing Smartphone signing Extension of signatures to partners and agents Signing individual documents without opening Finite one-off ini al purchase costs Cloud/SaaS opera on 14 AIIM / ARX

16 Addi on of signatures to mul ple file types Batch signing Manage signatures as part of AD profile Smartphone signing One click signature addi on and encapsula on Extension of signatures to partners and agents Mul ple signatures onto encapsulated docs Signing individual documents without opening Two-Factor Authentication Signing for SharePoint process steps The addition Finite of one-off two-factor ini al authentication purchase costs can be important to the integrity of a signing system, and is almost essential if a PKI Tablet mechanism signingis not used. Numeric keyfobs will be familiar from banking systems, Cloud/SaaS opera on and are popular as both a login validation and a signature authentication, as are proximity devices or Batch signing cards. Tablets and dedicated signing pads, and increasingly smartphone apps, are also in use, but not widely. Smartphone signing Extension of Figure signatures 18: to Do partners you use and any agents of the following for two-factor authentication? (N=71 users) Signing individual documents without opening 0% 10% 20% 30% 40% 50% 60% Finite one-off ini al purchase costs Numeric key fobs Cloud/SaaS opera on ipads or other tablets At login me Proximity devices/cards At signing me Smartphone app 0% 10% 20% 30% 40% 50% 60% Biometric Numeric authen ca on key fobs ipads Dedicated or other signing tablets pads At login me Proximity We do not devices/cards use two-factor At signing me authen ca on Smartphone app Biometric authen ca on Benefits and Return on Investment Dedicated signing pads Our survey shows that a digital signature 0% project 5% is usually 10% an easy 15% win 20% for the 25% IT department 30% 35% with 81% of users seeing We a do payback not use period of 12 months or less. 25% saw a spectacular ROI of 3 months or less. 3 months two-factor or less Our respondents are even authen ca on more confident of the returns in this survey than they were two years ago when 63% saw an ROI of 12 months 6 months or less. Figure 19: Considering financial, operational and customer-service benefits, what would you consider to be/will be the payback 9 months period from your investment in digital/electronic signature 12 months systems? (N=68 users) 18 months 0% 5% 10% 15% 20% 25% 30% 35% 3 months or less 2 years 6 months 3 years More 9 than months 3 years 12 months 18 months 2 years 3 years 0% 20% 40% 60% 80% Saving of staff me More scanning, than 3 copying years and rou ng documents Speeding up of approval process me AIIM / ARX Saving of paper-handling costs (eg, prints, 15

17 3 months or less 6 months 9 months We also asked those respondents 12 planning months a system for their payback expectation. Most (77%) were realistic in looking to a 12 month 18 months period, but only 35% predicted a 6 month or less payback, underestimating the 44% of actual users who achieved this. Few anticipate a 3 month payback. As we have outlined throughout the report, 2 years savings on the time and costs of physically handling documents, and the speeding up of approval 3 years processes are the biggest benefits from digital/electronic signatures. Proven compliance for otherwise electronic processes is also a key factor, and ease of signing for remote or travelling More staff. than 3 The years ability to include external approvers in the electronic cycle is ranked fairly low here, although respondents were limited to three choices. The increasing availability of cloud-based PKI solutions could be an important factor in extending the signing system outside the firewall. Figure 20: Which THREE of the following would you describe as the biggest benefits of your digital/electronic signatures system? (Max THREE) (N=78 users) Saving of staff me scanning, copying and rou ng documents Speeding up of approval process me Saving of paper-handling costs (eg, prints, copies, faxes, courier and post) Proven compliance for audit and electronic archive Ease of signing for remote, overseas, travelling or field-based staff Fewer lost documents Ability to include external approvers in the electronic cycle Be er customer service Environmental considera ons 0% 20% 40% 60% 80% Conclusion and Recommendations We have seen that the adoption of electronic and digital signatures has moved on apace since our last survey, rising from 24% two years ago to 35% now. This is no doubt driven by the very high ROI that we reported then, and which existing users have rated even more highly in this report, with 25% seeing a return within 3 months and the vast majority (81%) in less than 12 months. For those organizations who have not adopted digital or electronic signing solutions, the time-sapping requirement to halt processes and print off documents goes on, and the physical difficulties of putting those documents in front of signers who are remote, travelling or in other organizations continues to take up time and add costs for printing, postage, couriers, etc. Despite the very positive benefits, digital or electronic signature projects seem to have a low priority within IT departments, and IT staff are somewhat ambivalent about the technology most likely due to a lack of understanding about the different mechanisms. Business owners and authorized signers are keen to go ahead, and there is a clear majority of compliance and finance staff who are happy with the legal admissibility that digital (PKI) systems provide. Internal legal counsel are more evenly split, but there is a perceived impression that external auditors and lawyers are not enthusiastic, which may not in fact be the case, as they also incur huge costs from physical document handling. 16 AIIM / ARX

18 It is important that signing systems are easy to use and to manage through directory services, and that they cater for a broad spectrum of document types. Handling multiple signatures and the ability to integrate with ECM systems and process platforms is also important, in particular SharePoint. Packaged server or appliance-based products have made considerable headway compared to older, custom-built systems, and the solid admissibility aspects of the PKI mechanism are overcoming legacy arguments about authenticity. Recommendations Assess how many of your processes are interrupted by the need for a physical signature. Look at the delays introduced and the number of additional documents printed and handled. Consider the potential benefits if travelling and remote staff could quickly and easily sign off processes and approvals without the need to print and scan. For those processes where signatures are used, check regulatory and legal requirements to determine the validity of different signing options. Focus on authenticity, integrity, enforceability and non-refutability. Do not assume that your external auditors and lawyers distrust digital/electronic signatures ask them. Check how many of your staff are using simple bit-map images of their signatures, self-certified digital signatures within Word or Acrobat, or ad hoc PKI certificates. When considering solutions, check which integrate with your existing DM/ECM systems and process platforms. Take particular care if you are using SharePoint for sensitive processes. Check features such as multiple file formats, sign-and-seal, multiple signatures applied in order, batch approval of documents, and sign-off of workflow processes. Make an assessment of how many signers would benefit from the digital solution, and consider how difficult it would be to manage these on a one-by-one basis. Consider which solutions integrate and automatically synchronize with your Active Directory system. Be particularly wary of developing an in-house system. The system and your procedures both need to be robust in the event that they are ever questioned in court. A reputable packaged system may prove to be more convincing, and more cost-effective. References 1. AIIM Industry Watch, The Paper Free Office dream or reality Feb 2012, 2. Computer Desktop Encyclopedia 3. ISO 15489, Section BSI BIP 0008, Code of Practice for legal admissibility and evidential weight of information stored electronically 5. Electronic Signatures in Global and National Commerce, Public Law June, 2000 ref. 6. Digital Signature Standard (DSS) 7. ISO AIIM / ARX

19 Appendix 1: Survey Demographics Survey Background The survey was taken by 283 individual members of the AIIM community between 03 Oct 2012 and 05 Nov 2012 using a web-based tool. Invitations to take the survey were sent via to a selection of the 70,000 AIIM community members Organizational Size Organizations with less than 10 employees are excluded from all of the results in this report, taking the total to 263. On this basis, larger organizations (over 5,000 employees) represent 29%, with midsized organizations (500 to 5,000 employees) at 33%. Small-to-mid sized organizations (10 to 500 employees) are 39%. Geography 5,001-10,000 emps, 8% 5,001-10,000 emps, 8% over 10,000 emps, 21% over 10,000 emps, 21% 1,001-5,000 emps, 19% 1,001-5,000 emps, 19% Other W. E. Europe, Europe, Russia, 11% 2% Other W. Europe, UK 11% & Ireland, 11% UK & Ireland, 11% Canada, 12% 501-1,000 emps, 14% 501-1,000 emps, 14% emps, 17% emps, 17% emps, 22% emps, 22% The survey was international, with US and Canada making up 67% of respondents, and 24% from Europe. We found only minor differences Middle between East, US Asia, and Far European responses. Africa, S. Africa East, 1% 2% Australia, Central/S. NZ, 4% Middle East, Asia, Far America, Africa, S. Africa East, 1% 1% 2% E. Australia, Europe, Russia, NZ, 4% 2% Central/S. America, 1% US, 55% US, 55% Canada, 12% Aerospace, 1% 18 Media, Publishing, Other, please AIIM / ARX Web, 1% specify, 8%

20 UK & Ireland, Ireland, 11% 11% Canada, Canada, 12% 12% Industry Sector Local government and public services represent 16% and national government 5%. Finance, banking and insurance represent 10%. The remaining sectors are evenly split. Aerospace, Aerospace, 1% 1% Media, Media, Publishing, Publishing, Other, Other, please please Web, Web, 1% 1% specify, specify, 8% 8% Bureau/Outsource, Bureau/Outsource, Government Government & Public Services - & Public Services - 2% 2% Local/State, Local/State, 16% 16% Manufacturing, Manufacturing, Chemicals, Chemicals, 2% 2% Educa on, Educa on, 3% 3% Government Government && Public Public Services Services IT IT VAR, VAR, SI, SI, Reseller, Reseller, Na onal/federal, Na onal/federal, 5% 5% 3% 3% Engineering Engineering && Construc on, Construc on, 3% 3% Finance/Banking, Finance/Banking, 7% 7% Prof. Prof. Services Services && Legal, Legal, 3% 3% Oil Oil && Gas, Gas, Mining, Mining, 3% 3% Insurance, Insurance, 3% 3% Healthcare, Healthcare, 3% 3% Charity, Charity, Not-for- Not-for- Profit, Profit, 3% 3% IT IT && High High Tech Tech ECM ECM products products or or services, services, 10% 10% Consultants, Consultants, 4% 4% Retail, Retail, Transport, Transport, IT IT && High High Tech Tech not not Real Real Estate, Estate, 5% 5% Pharmaceu cal, Pharmaceu cal, ECM, ECM, 5% 5% Power, Power, U li es, U li es, Medical Medical Devices, Devices, Life Life Telecoms, Telecoms, 6% 6% Sciences, Sciences, 5% 5% Role 36% are from IT, 37% from RM/IM/Compliance, 27% have business roles. President, President, CEO, CEO, Managing Managing Director, Director, 2% 2% Line-of-business Line-of-business execu ve, execu ve, dept. dept. head head or or process process owner owner 11% 11% Other Other, 8%, 8% IT IT staff, staff, 13% 13% CIO/Head CIO/Head of of IT, IT, 5% 5% Business Business Consultant, Consultant, 6% 6% Head Head of of records/ records/ compliance/informa on compliance/informa on management, management, 13% 13% IT IT Consultant Consultant or or Project Project Manageer, Manageer, 18% 18% Records Records or or document document management management staff, staff, 24% 24% AIIM / ARX

21 Appendix 2: Digital Signature Primer For those who are unfamiliar with the technology, we need to establish the difference between electronic signatures and digital signatures. Some standards bodies and government regulations use the term electronic signature interchangeably between, say, scanned or fax signature images (i.e., digitized images ) and public-key encryption-based digital signatures. In the US, usage and legal admissibility is fairly consistent. An electronic signature is likely to be a bit-map representation, either from a scanned image, a fax copy or a picture of someone s signature, or may even be a typed acknowledgement or acceptance. A digital signature is extra data appended to a message which identifies and authenticates the sender and message data using public-key encryption 2. Some digital signature systems will combine the authenticated signature data with an associated bit-map image. Many types of signature are acceptable in law, subject to the judgement that the process used to apply the signature to the document and subsequently to present the document, has authenticity, integrity, enforceability and non-refutability i.e., that the right person applied the signature, that it can be recognized as their intent to endorse the document and that the document hasn t been subsequently tampered with. Establishing this in a court of law is obviously going to be somewhat easier with a digital signature than with a mere electronic one, although the legal admissibility of scanned documents is well covered in best practices and standards 3,4,5. Indeed, the same considerations would apply to a paper document with a physical signature. Some organizations go to elaborate lengths to password-protect scanned signatures, or to establish the authenticity of a check-box sign-off within a workflow process. Indeed, if this were contested, it would be the rigour and consistency of the process that would be challenged in the court, not the electronicsignature mechanism per se. Digital signatures, on the other hand, provide a standard and convenient mechanism whereby the unique application of the signature by the signee is established by the combination of applying their private signing key along with their personal ID certificate containing their public key. The subsequent verification of this signing process by any third party requires just the public key ID certificate. In addition, a checksum mechanism confirms that there have been no modifications to the content. The public-private key combination is generally self-generated but its associated certificate may be issued (purchased) from a trusted Certificate Authority (CA) or may belong to a corporation. Self-certified public keys at a corporate or organizational level may also be used, but they require an agreement with recipients because they do not automatically establish the verifiable identity of the signee. They work well within communities of signers. Digital signature standards are mature, and converging internationally 6,7. Confusion frequently arises between the usage of digital signatures and document encryption. Full document encryption ensures that only those co-operating persons who possess a shared secret key can read the contents of the document, thereby securing it against any third party access. Alternatively, especially for s, both parties can agree to mutually trust one or more CAs who will underwrite a personal digital certificate for each party. Unless it is absolutely essential, full document encryption is often advised against for use within electronic records management systems as it prevents full-text indexing, and requires that the decryption keys (and application) are available for any future access. Furthermore, if the decryption key is lost or an employee leaves without passing it on, encrypted documents and records will in effect be electronically shredded as no one will be able to read them. Correctly certified digital signatures do not prevent unauthorized persons reading a document nor are they intended to. They do confirm that the person who signed it is who they say they are, and that the document has not been altered since they signed it. Within a records management system a digital signature is often considered to be an important part of the metadata of a document, confirming both its heritage and its integrity. Administering digital signatures in an ad-hoc way within a corporate environment can prove to be something of an overhead enrolling and revoking users, obtaining certificates from a trusted certificate authority, providing user access licences to signature-supporting applications, administering password 20 AIIM / ARX